4beabc6db31f59fbbba995513f8518498b3ddd7a2bb869397b57ed1f0f98828b

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
Size

694KB
MD5

f5f6146b9517c2c878aef2fb406816fc
SHA1

851f52ded8e836fb07669da104e6e4a1936bef44
SHA256

4beabc6db31f59fbbba995513f8518498b3ddd7a2bb869397b57ed1f0f98828b
SHA512

faee7265a183bc5f196b5cb19e3bfbabf54c2edfaed0a1e2b718c243ab4c4af26874026e598cd7a666d27d8dfc7151c25a54f9d59325dde1807d6ff1d35f6d15
SSDEEP

12288:CajfGRq/OFwiLcwejwRsLvpA23rMiK/lGRgOUqmq9kR6lhKXNZffDAw9Fa3MTHp:mWBiHe0Rsd53nK/cRgOnmq9g6aFfDAve

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 set thread context of 0	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 4856	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	84
PID 1448 wrote to memory of 0	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 1448 wrote to memory of 0	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 1448 wrote to memory of 0	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 1448 wrote to memory of 0	1448	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe"
  2⤵
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-18-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-25-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-2-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1448-4-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1448-5-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1448-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1448-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1448-7-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1448-9-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-10-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-8-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1448-12-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-13-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-16-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-1-0x00000000022B0000-0x0000000002310000-memory.dmp

Filesize
384KB

Download
memory/1448-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1448-27-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-19-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-34-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-21-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-17-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-26-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1448-14-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-28-0x00000000022B0000-0x0000000002310000-memory.dmp

Filesize
384KB

Download
memory/1448-29-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/1448-24-0x00000000033D0000-0x00000000033EB000-memory.dmp

Filesize
108KB

Download
memory/4856-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4856-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4856-31-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4856-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads